CVE-2024-58258: SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can occur.

PriorityP262high7.2CVSS 3.1

AVNACLPRNUINSCCLILAN

EXPLOIT

EPSS

13.25%

95.9th percentile

SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can occur.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
sugarcrm	sugarcrm	< 13.0.4	13.0.4
sugarcrm	sugarcrm	>= 14 < 14.0.1	14.0.1

Detection & IOCsextracted from sources · hover to see the quote

url/rest/v10/css/preview?baseUrl=1&param=<LESS_INJECTION>↗

command1; @import (inline) '<TARGET>'; @import (inline) 'data:text/plain,________';//↗

urlhttp://169.254.169.254/latest/meta-data/↗

urlhttp://localhost:9200/_search↗

path/rest/v10/css/preview↗

→Monitor HTTP GET requests to /rest/v10/css/preview containing URL-encoded LESS @import directives in the 'param' query parameter, especially patterns matching '%40import' or '@import (inline)'. ↗
→Alert on unauthenticated requests to /rest/v10/css/preview where the 'param' value contains semicolons and @import statements, indicative of LESS code injection attempts. ↗
→Detect outbound SSRF attempts originating from the SugarCRM web server process targeting internal metadata endpoints (e.g., 169.254.169.254) or internal services (e.g., Elasticsearch on port 9200), triggered via the css/preview endpoint. ↗

·The vulnerability is exploitable by remote, unauthenticated attackers — no credentials or session are required to trigger the SSRF or file read via the css/preview endpoint. ↗
·Affected scope covers all SugarCRM commercial versions before 13.0.4 and before 14.0.1; both the 13.x and 14.x branches are vulnerable. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.